CVE-2026-41889 pgx: SQL Injection via placeholder confusion with dollar quoted string literals

Low 2.3 Published 8 May 2026 Updated 8 May 2026

Attackers can execute arbitrary SQL commands via placeholder confusion in dollar-quoted strings when using the non-default simple protocol in the pgx Go driver.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-41889?

CVE-2026-41889 is a low-severity SQL injection vulnerability in jackc pgx, published on 8 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2.

Weakness: CWE-89

Which versions are affected by CVE-2026-41889?

9 open source packages ship an affected version, including github.com/jackc/pgx, github.com/jackc/pgx/v4 and github.com/jackc/pgx/v5. It affects 1 product.

Package	Affected	Fixed in
`github.com/jackc/pgx` Go	All versions	None
`github.com/jackc/pgx` Go	All versions to `3.6.2`	None
`github.com/jackc/pgx` Go	All versions to `3.6.2`	None
`github.com/jackc/pgx/v4` Go	All versions	None
`github.com/jackc/pgx/v4` Go	All versions to `4.18.3`	None
`github.com/jackc/pgx/v4` Go	All versions to `4.18.3`	None

3 more packages

`github.com/jackc/pgx/v5` Go	All versions	`5.9.2`
`github.com/jackc/pgx/v5` Go	All versions	`5.9.2`
`github.com/jackc/pgx/v5` Go	All versions	`5.9.2`

Linux distribution packages (7)

`caddy` Red Hat:hummingbird:1	All versions	`0:2.11.3-0.1.hum1`
`go-fdo-server` Red Hat:hummingbird:1	All versions	`0:1.0.1-0.2.hum1`
`go-fdo-server-manufacturer` Red Hat:hummingbird:1	All versions	`0:1.0.1-0.2.hum1`
`go-fdo-server-owner` Red Hat:hummingbird:1	All versions	`0:1.0.1-0.2.hum1`
`go-fdo-server-rendezvous` Red Hat:hummingbird:1	All versions	`0:1.0.1-0.2.hum1`
`alloy` openSUSE:Tumbleweed	All versions	`1.16.1-2.1`
`steampipe` openSUSE:Tumbleweed	All versions	`2.4.4-1.1`

Products include Jackc Pgx.

How do I fix CVE-2026-41889?

Upgrade to a fixed version.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2026-41889 being exploited?

There is no known exploitation of CVE-2026-41889 in the wild and no public exploit code.

Sources

Also known as AZL-86322, AZL-86325, CLEANSTART-2026-FX70874, CLEANSTART-2026-IO66056, CLEANSTART-2026-MY24201, CLEANSTART-2026-SL23707 and 145 more.